Should I include the ciphertext length in an AAD when using Chacha20+Poly1205 AEAD?

Question

I want to construct a time-limited authorization token using ChaCha20 and Poly1305 as defined by RFC7539. I chose the following simple layout:

version || nonce || ciphertext || Poly1305 tag
1B         12B      *B            16B

where the concatenation of version and nonce is used as the Poly1305's AAD.

However, this scheme does not explicitly specify the length of the ciphertext to follow, so an attacker may want to try to truncate or expand the ciphertext section of the token. If I add the ctlength value between version and nonce, will it improve security?

Answer 1

It is not necessary; ChaCha20+Poly1305 already includes the length of the ciphertext into the data which is MACed (and hence stirs it into the tag), hence you don't need to. If someone appends or truncates ciphertext data, they'd change the data the MAC is computed over, and so the tag would not verify.

We can see the pseudocode (in section 2.8.1 of the RFC) which includes the ciphertext length in this line:

    mac_data |= num_to_4_le_bytes(ciphertext.length)
    tag = poly1305_mac(mac_data, otk)

Now, it won't hurt things if you decide to include the length into the AAD; however that's something that the designers have already thought of, and so you don't need to.